A panel discussion on practical software security strategies for developers, covering the expanding attack surface in the AI era, broken access control as the top OWASP risk, the dangers of blindly trusting AI-generated code, and the importance of threat modeling. Panelists emphasize that AI empowers both attackers and defenders, that exploit timelines have shrunk from weeks to under a day, and that LLMs are non-deterministic and should not be used to make security decisions. Actionable recommendations include: sandboxing development environments, generating and monitoring SBOMs, using industry-standard access control libraries instead of rolling your own, adding security checks to AI prompts and specs, implementing continuous monitoring alongside CI/CD, and consulting resources like OWASP, OSSF, SLSA, and Google's SAIF framework. The EU Cyber Resilience Act's December 2027 SBOM verification deadline is highlighted as a compliance driver.
Sort: